What distinguishes a supply chain compromise from a direct network intrusion, and name one mitigation?

• A. A supply chain compromise occurs during the procurement of software/hardware; mitigation: SBOM, code signing, vendor risk management.
• B. Direct network intrusion occurs only in cloud environments; mitigation: using strong passwords.
• C. A supply chain compromise is the same as a direct intrusion; mitigation is to install antivirus software.
• D. Direct network intrusion occurs at the user level; mitigation is user education.

Answer: (C)

A supply chain compromise happens when the malicious element is introduced into a product or component during its creation, manufacturing, or delivery—so you end up receiving software or hardware that’s already tampered with before you install or use it. A direct network intrusion, on the other hand, is an attacker breaching your own environment by gaining access to your network or systems after you’ve received the product, often by exploiting flaws, weak credentials, or misconfigurations.

One effective mitigation is code signing. When software is code-signed by the publisher, the signature lets you verify that the code hasn’t been altered since it was signed and that it truly comes from a trusted source. This helps prevent tampered software from being installed, which is a common route in supply chain attacks.